This vulnerability (CVE-2026-26107) is a use-after-free issue in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally by exploiting the improper handling of memory after it has been freed. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted application and system. This can result in unauthorized actions performed with the privileges of the user running the application.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26107 to ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version.